openproject/config/initializers/mass_assignment.rb

class ActiveRecord::Base
  # for full security the following call will disallow any attributes by default
  # attr_accessible

  # call this to force mass assignment even of protected attributes
  def force_attributes=(new_attributes)
    self.send(:attributes=, new_attributes, false)
  end

  # this override will protected the foreign key of certain belongs_to associations by default (see #protected_association?)
  # def self.belongs_to(association_id, options = {})
  #   ret = super
  #   if protected_association? association_id
  #     foreign_key = options[:foreign_key] || "#{association_id}_id"
  #     attr_protected foreign_key
  #   end
  #   ret
  # end

  private
  # def protected_association?(association_id)
  #   PROTECTED_ASSOCIATIONS.include? association_id.to_s
  # end
  #
  # PROTECTED_ASSOCIATIONS = %w[project user author]
end